In short: Cyber Essentials is mandatory for law firms with legal aid contracts: the Legal Aid Agency's Provider Data Security Requirements v5 require Cyber Essentials, or an equivalent standard, for the life of contracts coming into force on or after 1 October 2025, and recommend Cyber Essentials Plus. For other firms it is not a legal requirement, but many clients ask for it.
What the Legal Aid Agency requires
The Legal Aid Agency publishes data security requirements that providers must meet under their contracts, with a separate guidance document explaining how. The current version, Provider Data Security Requirements v5, was issued on 1 October 2025. On certification it says:
| Requirement | Status in v5 | What it asks for |
|---|---|---|
| 19a: Cyber Essentials | Mandatory | Hold Cyber Essentials certification for the life of the contract, or an equivalent standard |
| 19b: Cyber Essentials Plus | Recommended | Hold Cyber Essentials Plus and renew or maintain it as required, or an equivalent standard |
The LAA says which version applies by contract start date: version 5 covers contracts coming into force on or after 1 October 2025, version 4 covers those from 1 September 2024 to 30 September 2025, and version 3 those before. Version 4 had added Cyber Essentials Plus as a recommendation; version 5 made Cyber Essentials itself mandatory.
"For the life of the contract" matters. A certificate lasts 12 months, so a provider must renew every year without a gap. Always check your own contract and the current LAA documents on gov.uk, because the specific contract terms take precedence over any summary, including this one.
The rest of the LAA requirements
Cyber Essentials sits alongside other LAA requirements that it does not cover, including registering as a data controller with the Information Commissioner's Office (unless an exemption applies), appointing a senior Data Protection Supervisor, an induction and annual awareness plan for staff, data protection impact assessments where appropriate, physical security of premises, a coherent set of policies (including remote or home working where permitted), an incident management policy, staff screening, access records and secure disposal of media.
Cyber Essentials gives you independent evidence for the technical side. The governance side needs its own policies and records; if you want a certified management standard for that too, compare Cyber Essentials vs ISO 27001 and IASME Cyber Assurance.
Commercial clients, confidentiality and email fraud
Outside legal aid, Cyber Essentials is often a client expectation. Corporate clients, insurers and public-sector buyers send supplier security questionnaires, and a current certificate answers many of the technical questions at once. Public bodies buying legal services under PPN 014 can require it before award.
Legal practices also face a particular threat: email-borne fraud. Criminals who get into a fee earner's mailbox can watch a conveyancing or settlement matter and send convincing payment instructions at the critical moment. Cyber Essentials helps directly, because it requires:
- MFA on cloud email and every other cloud service, so a stolen password is not enough on its own to get into a mailbox. Under the Danzell question set, missing MFA on a cloud service that offers it is an automatic fail. See Cyber Essentials MFA.
- Separate admin accounts, so a compromised fee earner account cannot change system settings.
- Malware protection on every device; where you use anti-malware software it must also block connections to malicious websites, which reduces the damage from a clicked link.
It does not stop a well-crafted request for payment on its own. Email security and staff training close that gap: see email security and phishing awareness training.
Barristers' chambers and smaller practices
Chambers present a classic scoping challenge: self-employed barristers often use their own laptops and phones for chambers email, diary and document systems. Devices that access the organisation's data or services are in scope, so chambers need to decide who the applying organisation is, which legal entities are involved and how members' devices will meet the controls. Under Danzell every in-scope legal entity must be listed on the assessment. See defining your scope and BYOD and home working.
Barristers were added to the NCSC's Funded Cyber Essentials Programme in February 2025, but the NCSC described that year as the programme's final one and we found no open round in October 2026; see funded Cyber Essentials. For sole practitioners and small firms, the practical points in Cyber Essentials for small businesses apply too.
Cyber Essentials or Cyber Essentials Plus?
The LAA mandates Cyber Essentials and recommends Cyber Essentials Plus. Plus uses the same controls but adds hands-on testing by an assessor: an external vulnerability scan, authenticated scans of a sample of devices for missing patches, malware tests, checks that MFA is configured on cloud services and checks on account separation. It must be completed within three months of the self-assessment certificate.
Firms handling high-value transactions or large volumes of sensitive client data often choose Plus because it proves the controls work, not just that they are claimed. Compare the two on Cyber Essentials vs Cyber Essentials Plus, and see what the audit checks on Cyber Essentials Plus requirements.
How we help legal practices
Forever Systems prepares law firms and chambers for Cyber Essentials and Cyber Essentials Plus and supports them through assessment alongside an IASME-licensed Certification Body; we do not issue certificates. We review your case management and practice management systems, Microsoft 365 tenant, devices and remote access against the current question set, fix the gaps, and help you keep certified for the whole contract term so renewal never lapses.
Pricing depends on the size of the firm and the level you need, so ask us for a quote. Contact us to discuss your contract requirements.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Cyber Essentials mandatory for legal aid providers?
Yes. The Legal Aid Agency's Provider Data Security Requirements v5 (October 2025) make holding Cyber Essentials, or an equivalent standard, a mandatory requirement for the life of the contract. Version 5 applies to contracts coming into force on or after 1 October 2025.
Does the LAA require Cyber Essentials Plus?
Cyber Essentials Plus is recommended, not mandatory, in version 5 of the LAA requirements. Cyber Essentials itself, or an equivalent standard, is mandatory.
What happens if a legal aid provider's Cyber Essentials certificate expires?
The LAA requirement is to hold the certificate for the life of the contract, and certificates expire after 12 months. Plan renewal well before expiry and check your contract for the consequences of a lapse.
Do solicitors need Cyber Essentials if they do not do legal aid?
There is no general legal requirement, but many corporate and public-sector clients ask for it in supplier questionnaires and tenders, and it gives independent evidence that the basic technical controls are in place.
Are barristers' own laptops in scope for chambers' Cyber Essentials?
Devices that access the organisation's data or services are in scope, so members' laptops and phones used for chambers systems usually need to meet the controls. Scoping chambers carefully, including which legal entities apply, is an important first step.